[lambda] Grant invoke on imported lambda fails

[tbartley]

Imported lambda's can no longer be granted permission to invoke a lambda within a stack.

Reproduction Steps

const localFunction = new Function(this, 'Local', {...})
const foreignRoleArn = Role.fromRoleArn(this, 'ForeignRole', 'foreign-lambda-role-arn')
const foreignFunction = Function.fromFunctionAttributes(this, 'Foreign', {
    functionArn: 'foreign-lambda-arn',
    roleArn: foreignRoleArn
})
localFunction.grantInvoke(foreignFunction)

What did you expect to happen?

In 1.59.0 and earlier it succeeded.

What actually happened?

Since 1.60.0 this now fails with error:

Error: Invalid principal type for Lambda permission statement: Import. Supported: AccountPrincipal, ArnPrincipal, ServicePrincipal.

Environment

• CLI Version : 1.60.0
• Framework Version:
• Node.js Version: 12
• OS : MacOS
• Language (Version): Typescript 3.9.7

Other

---

This is 🐛 Bug Report

[nija-at]

Ack that this is a regression introduced in 1.60.0. The bug is coming from here -

aws-cdk/packages/@aws-cdk/aws-lambda/lib/function-base.ts

Line 270 in e893828

public grantInvoke(grantee: iam.IGrantable): iam.Grant {

Previously, the code behaviour was to add lambda:Invoke to the IAM role, but the call is attempting to add a AWS::Lambda::Permission resource by calling addPermission() API.

Ran git bisect between the two versions and the offending commit is - d6278b3.

@skinny85 - can you take a look at this and prepare a fix?